Misuse of your personal data: your GDPR rights
In Malta your personal data is protected by the EU General Data Protection Regulation (GDPR) together with the national Data Protection Act. You have rights to access your data, to have it corrected or erased, to object to certain processing, and to complain to the Information and Data Protection Commissioner if an organisation misuses your data.
Key facts
Deadline
A controller must normally respond to a data subject request within one month. You can lodge a complaint with the Information and Data Protection Commissioner without a strict deadline, but act promptly while evidence is fresh.
What to do
- Identify who is processing your data (the controller) and what exactly you object to.
- Send a written request exercising your rights, for example access, rectification, erasure or objection.
- Keep copies of your request and the organisation's reply, and note the one-month response window.
- If the response is unsatisfactory or absent, lodge a complaint with the Information and Data Protection Commissioner (IDPC).
- Where you have suffered damage, you may also claim compensation before the courts.
- Document any evidence of the misuse, such as emails, screenshots and marketing you did not consent to.
What to watch out for
- Vague or verbal requests are easy to ignore; put your request clearly in writing.
- Waiting too long can make it harder to prove misuse.
- Not all processing is unlawful; the organisation may have a legal basis, so identify the specific breach.
- A complaint to the IDPC is separate from any court claim for damages; consider both where relevant.
Legal basis
Frequently asked questions
Which law protects my personal data in Malta?
The EU General Data Protection Regulation (GDPR), supplemented nationally by the Data Protection Act (Cap. 586).
How quickly must an organisation reply to my request?
Generally within one month under the GDPR, as applied through the Data Protection Act (Cap. 586).
Where do I complain about misuse of my data?
To the Information and Data Protection Commissioner (IDPC), the supervisory authority under the Data Protection Act (Cap. 586) and the GDPR.